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IN THE CLAIMS 



1 . (Currently Amended) A computer implemented method to diagnose a problem from 
multiple events in a system of managed components generating real-time events of problems, 
comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 

sampling a portion of generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

2. (Original) The method of claim 1, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

3. (Original) The method of claim 2, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 

4. (Original) The method of claim 3, wherein the system comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 
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5. (Original) The method of claim 3, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 

6. (Previously Presented) The method of claim 5, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 

7. (Original) The method of claim 6, wherein determining the event nodes comprises: 
determining the event nodes from a database defining the network managed objects and 

event notifications that convey the state of one or more managed objects. 

8. (Original) The method of claim 7, wherein determining the event nodes further 
comprises: 

determining the event nodes from expert knowledge of the network. 

9. (Original) The method of claim 8, wherein the managed objects comprise: 
objects selected from the group consisting of network objects, attached systems, and 

application objects. 

10. (Previously Presented) The method of claim 8, wherein the database comprises: 
static information associated with each class of managed or dynamic information that 

affects the causal propagation of events. 

1 1 . (Currently Amended) The method of claim 3, wherein sampling the incoming real-time 
events comprises: 

sampling a portion of the incoming real-time events sequentially in the order they are 
received. 
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12. (Original) The method of claim 3, wherein identifying the concept nodes comprises: 
identifying a composite set of events that capture the notion of an abstract exception 

condition in the network. 

13. (Original) The method of claim 12, wherein the abstract exception condition comprises: 
abstract exception conditions selected from the group consisting of a notion of fault and a 

notion of performance degradation, a network card in a communication system being faulty with 
the number of users being served by the communication system drastically reducing, and link 
between two routers going down leading to the use of alternate paths which lead to congestion 
and performance. 

14. (Original) The method of claim 12, wherein capturing the abstract exception condition 
comprises: 

capturing normal paths based on predetermined criteria on which the events have to be 
diagnosed. 

15. (Original) The method of claim 14, wherein the criteria comprises: 
causal and temporal inconsistencies between events. 

16. (Original) The method of claim 1, wherein forming the FCM, comprises: 
capturing system event interdependencies. 

17. (Original) The method of claim 1 5, wherein capturing the system event 
interdependencies comprises: 

interconnecting event and concept nodes using interdependency arcs capturing temporal 
and logical dependencies. 
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18. (Original) The method of claim 17, wherein the interdependency arcs comprise: 
weights based on temporal and logical dependencies. 



19. (Original) The method of claim 3, wherein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 

computing an indirect effect of events (predictive event-correlation) on concept nodes 
using the equations: 

I px (E i; CD = min( £px (E i5 Cj)) = min( &px ^ (E i; E k )) © © min( 6p% (E^ Cj)) 

wherein the indirect effect of events Ej on concept nodes Q can be defined as the intersection 

of the linked causal types and can be described by the above equation, g is a function which takes 

px 

Iij to [0,1] in path 'p' i.e. e K j = f -> (\ \^ ), u.y e {0,1 }, and © represents a concatenation of paths, 
wherein the concatenation operator® is generally considered as a fuzzy 'and' operator, wherein the 
operator (t-norm) for intersection of two fuzzy sets other than 'min' can be used using a 'bounded 
difference,' wherein the bounded difference can be computed using the equation: 

U ( Ma (X) ' Mb = maX < 0 ' M A W + M B <*> ~ 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions u-a and 

20. (Original) The method of claim 1 9, wherein mapping the received real-time events to the 
formed FCM fragments comprises: 

correlating the received events to the identified concept nodes to evaluate the effect of the 
received event nodes on the identified concept nodes using the determined element 
interdependencies. 

21 . (Original) The method of claim 20, wherein correlating the received events to the 
concept nodes further comprises: 

accumulating evidence based on the received event nodes; 
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comparing the accumulated evidence to a threshold value; and 

analyzing the concept nodes based on the outcome of the comparing to evaluate the effect 
of the received event nodes. 



22. (Currently Amended) A computer implemented method for diagnosing problems from 
multiple events in a communication network including managed components generating real- 
time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 

using network element interdependencies; 

sampling a portion of generated incoming real-time events from the network; and 
diagnosing each of the generat e d problems by mapping the received sampled events to the 

formed FCM fragments. 

23. (Original) The method of claim 22, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

24. (Original) The method of claim 23, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 



25. 



(Currently Amended) A computer readable medium having computer-executable 
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instructions to diagnose problems from multiple events in a system of managed components 

generating real-time events of problems, comprising: 

forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 

using network element interdependencies derived from a database defining the network managed 

objects and event notifications that convey the state of one or more managed objects; 

samplin g a portion of generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

26. (Original) The computer readable medium of claim 25, wherein forming the FCM 
fragments comprises: 

determining event nodes from events in the database; 
identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

27. (Previously Presented) The computer readable medium of claim 26, wherein diagnosing 
the sampled events comprises: 

mapping the sampled real-time events to the formed FCM fragments including 
determined event nodes to evaluate the effect of the mapped event nodes on the identified 
concept nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on activation levels of the 
concept nodes; and 

diagnosing the problems based on the outcome of the analysis. 



28. (Original) The computer readable medium of claim 27, wherein the system comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 
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29. (Original) The computer readable medium of claim 28, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 



30. (Previously Presented) The computer readable medium of claim 29, wherein the event 
nodes comprise: 

significant events selected from the group consisting of hardware failures, software 
failures, performance bottlenecks, configuration problems, and security violations. 

3 1 . (Original) The computer readable medium of claim 27, wherein identifying the concept 
nodes comprises: 

identifying a composite set of events that capture the notion of an abstract exception 
condition in the network. 



32. (Original) The computer readable medium of claim 27, wherein evaluating the effect of 
the received event nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 

I px (Ei, Cf) = min( e (Ei, Cj)) = min( 6px (E,, E k )) © © min( ^ (E kn , Cj)) 

wherein the indirect effect of events Ej on concept nodes Cj can be defined as the intersection 
of the linked causal types and can be described by the above equation, g is a function which takes 

Iij to [0,1] in path 'p' i.e. enj = f -> (\ Ujj ), Uij e {0,1}, and © represents a concatenation of paths, 
wherein the concatenation operator © is generally considered as a fuzzy ' and' operator, wherein the 
operator (t-norm) for intersection of two fuzzy sets other than 'min' can be used using a 'bounded 
difference,' wherein the bounded difference can be computed using the equation: 



U ( JU A (x) ' Mb (x)) = maX { °' M A ^ + Mb (x) ~ 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions u. A and 
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33. (Currently Amended) A computer system to diagnose problems from multiple events in a 
system of managed components generating real-time events of problems, comprising: 

a storage device; 
an output device; and 

a processor programmed to repeatedly perform a method, comprising: 
forming fuzzy cognitive maps (FCMs) including causally equivalent FCM fragments 
using network element interdependencies derived from a database defining the network managed 
objects and event notifications that convey the state of one or more managed objects; 

samplin g a portion of generated incoming real-time events from the system; and 
diagnosing problems by mapping the sampled events to the formed FCM fragments. 

34. (Original) The system of claim 33, wherein forming the FCM fragments comprises: 
determining event nodes from events in the database; 

identifying concept nodes from the determined event nodes; and 
forming FCM fragments including interdependencies between the concept and event 
nodes using the determined event nodes and the identified concept nodes. 

35. (Original) The system of claim 34, wherein diagnosing the sampled events comprises: 
mapping the sampled real-time events to the formed FCM fragments including 

determined event nodes evaluate the effect of the mapped event nodes on the identified concept 
nodes using the determined interdependencies; 

identifying the problems by analyzing the concept nodes based on the outcome of the 
evaluation; and 

diagnosing the problems based on the outcome of the analysis. 



36. (Original) The system of claim 35, wherein the events comprise: 
exceptional conditions occurring in the operation of the network. 
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37. (Previously Presented) The system of claim 35, wherein the event nodes comprise: 
significant events selected from the group consisting of hardware failures, software 

failures, performance bottlenecks, configuration problems, and security violations. 

38. (Original) The system of claim 35, wherein identifying the concept nodes comprises: 
identifying a composite set of events that capture the notion of an abstract exception 

condition in the network. 

39. (Original) The system of claim 35, wherein forming the FCM, comprises: 
capturing system event interdependencies by interconnecting event and concept nodes 

using interdependency arcs that capture temporal and logical dependencies. 

40. (Original) The system of claim 35, wherein evaluating the effect of the received event 
nodes on the concept nodes, comprises: 

computing an indirect effect of events on concept nodes using the equations: 

I px (Ei, CO = min( 6px (Ej, Cj)) = min( 6p% (E„ E k )) © © min( e ^ (E kn , Cj)) 

wherein the indirect effect of events Ej on concept nodes Cj can be defined as the intersection 

of the link causal types and can be described by the above equation, p is a function which takes I y 

px 

to [0,1] in path 'p' i.e. enj = f -> (Iy, u,y ), u.y e {0,1}, and ® represents a concatenation of paths, 
wherein the concatenation operator © is generally considered as a fuzzy ' and' operator, wherein the 
operator (t-norm) for intersection of two fuzzy sets other than 'min' can be used using a 'bounded 
difference,' wherein the bounded difference can be computed using the equation: 

U ( M A Mb W) = maX { °' M A W + M B W ~ 1} 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions u. A and 
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41 . (Currently Amended) An event-correlation system to diagnose problems from multiple 
incoming real-time events in a communication network of managed components generating real- 
time events of problems, comprising: 

an event-analyzer to form fuzzy cognitive map (FCM) fragments using network element 
interdependencies derived from a database defining the network managed objects and event 
notifications that convey the state of one or more managed objects; and 

an event-processing module coupled to the event-analyzer to sample a portion of 
generated incoming real-time events from the network, wherein the analyzer to diagnose the 
problems from the sampled events by mapping the sampled events to the formed FCM 
fragments. 

42. (Original) The event-correlation system of claim 41 , wherein the analyzer forms FCM 
fragments by determining event nodes from events in the database, and by further identifying 
concept nodes from the determined event nodes to form FCM fragments including 
interdependencies between the identified concept nodes and the determined event nodes. 

43. (Original) The event-correlation system of claim 41, wherein the analyzer further maps 
the sampled events to the formed FCM fragments including determined event nodes to evaluate 
the effect of the mapped events on the determined concept nodes using the determined 
interdependencies, wherein the analyzer identifies the problems by analyzing the concept nodes 
based on the outcome of the evaluation and further diagnoses the problems based on the outcome 
of the analysis. 

44. (Original) The event-correlation system of claim 43, wherein the communication 
network comprises: 

a system selected from the group consisting of explicit system, implicit system, 
centralized system, partially centralized system, and distributed system. 
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45. (Original) The event-correlation system of claim 43, wherein the events comprise: 
exceptional conditions occurring during operation of the network. 

46. (Previously Presented) The event-correlation system of claim 45, wherein the event 
nodes comprise: 

significant events selected from the group consisting of hardware failures, software 
failures, performance bottlenecks, configuration problems, and security violations. 

47. (Original) The event-correlation system of claim 46, wherein the analyzer determines the 
event nodes from a database defining the network managed- objects and event notifications that 
convey the state of one or more managed objects. 

48. (Original) The event-correlation system of claim 47, wherein the analyzer determines the 
event nodes from expert knowledge of the network. 

49. (Original) The event-correlation system of claim 48, wherein the managed objects 
comprise: 

objects selected from the group consisting of network objects, attached systems, and 
application objects. 

50. (Previously Presented) The event-correlation system of claim 48, wherein the database 
comprises: 

static information associated with each class of managed objects or dynamic information 
that affects the causal propagation of events. 



51. 



(Original) The event-correlation system of claim 43, further comprising: 
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a communication interface module coupled between the network and the event- 
processing module to extract events from real-time messages received in different formats from 
the network and to further sample the extracted events sequentially in the order they are received. 

52. (Original) The event-correlation system of claim 43, wherein the analyzer identifying the 
concept nodes comprises a composite set of events that capture a notion of an abstract exception 
condition in the network. 

53. (Original) The event-correlation system of claim 52, wherein the abstract exception 
condition comprises conditions selected from the group consisting of a notion of fault and a 
notion of performance degradation. 

54. (Original) The event-correlation system of claim 52, wherein the analyzer captures the 
abstract exception condition by capturing normal paths based on predetermined criteria from 
which for the events are diagnosed. 

55. (Original) The event-correlation system of claim 54, wherein the criteria comprises: 
causal and temporal inconsistencies between events. 

56. (Original) The event-correlation system of claim 43, wherein the analyzer forms FCM by 
capturing system event interdependencies. 

57. (Original) The event-correlation system of claim 56, wherein the analyzer captures 
system interdependencies by interconnecting event and concept nodes using interdependency arcs 
to capture temporal and logical dependencies. 



58. (Previously Presented) The event-correlation system of claim 57, wherein the 
interdependency arcs comprise: 
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weights based on temporal and logical dependencies. 



59. (Original) The event-correlation system of claim 43, wherein the analyzer evaluates an 
indirect effect of events on concept nodes using the equations: 

I px (E i5 Q) = min( 6px (E i; Cj)) = min( (Ej, E k )) © © min( 6p% (E^, Cj)) 

wherein the indirect effect of events Ej on concept nodes Q can be defined as the intersection 
of the link causal types and can be described by the above equation, g^. is a function which takes \ 

to [0,1] in path 'p' i.e. = f -> (Iy, uij ), u-y e {0,1}, and © represents a concatenation of paths, 
wherein the concatenation operator 0 is generally considered as a fuzzy 'and' operator, wherein the 
operator (t-norm) for intersection of two fuzzy sets other than 'min' can be used using a 'bounded 
difference,' wherein the bounded difference can be computed using the equation: 

U ( M A W ' Mb = maX { °' Ma W + Mb (x) " *> 

wherein ti() is a t-norm between fuzzy sets A and B with membership functions \x A and 

60. (Original) The event-correlation system of claim 59, wherein the analyzer maps the 
received real-time events to the formed FCM fragments by correlating the received events to the 
identified concept nodes to evaluate the effect of the received event nodes on the identified 
concept nodes using the determined element interdependencies. 

61. (Original) The event-correlation system of claim 59, wherein the analyzer correlates the 
received events by accumulating evidence based on the received event nodes and compares the 
accumulated evidence to a threshold value, and analyzes the concept nodes based on the outcome 
of the comparing to evaluate the effect of the received event nodes. 



62. 



(Original) The event-correlation system of claim 43, further comprising: 
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an interface output module coupled to the event-analyzer to output one or more solutions 
based on the outcome of diagnosing the problems by the analyzer. 



63. (Original) The event-correlation system of claim 62, further comprising: 
a memory to store the static and dynamic information. 



